fix: high-severity findings from code audit

- backend/photos: whitelist sortable columns instead of getattr(Photo, sort).
  Previously any client-supplied string was passed to SQLAlchemy, exposing
  every Photo attribute (filepath, file_hash, etc.) as a sort target.
- App: move the auto-show-right-sidebar logic out of the render body and
  into a useEffect. The previous version called setState during render,
  causing extra re-render passes the audit caught.
- types/photo: add added_at and tighten folder_id from optional to nullable.
  Drops a (photo as any).added_at cast in Timeline.
- constants/colorLabels: extract a single COLOR_LABEL_OPTIONS used by
  FilterBar, RightSidebar, and PhotoInfoPanel. filterStore re-exports the
  ColorLabel type so existing imports keep working.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/App.tsx

@@ -1,4 +1,4 @@
-import { useState } from 'react'
+import { useEffect, useState } from 'react'
 import { Timeline } from './components/timeline/Timeline'
 import { LeftSidebar } from './components/layout/LeftSidebar'
 import { RightSidebar } from './components/layout/RightSidebar'
@@ -37,13 +37,16 @@ function App() {
 
   // Auto-show right sidebar when photos are selected — but only in grid mode,
   // so leaving the preview doesn't fight the user's prior sidebar state.
-  if (viewMode === 'grid') {
+  // Lives in an effect (not the render body) to avoid setState-during-render
+  // and the cascading re-renders the audit caught.
+  useEffect(() => {
+    if (viewMode !== 'grid') return
     if (selectedPhotos.length > 0 && !rightSidebarOpen) {
       setRightSidebarOpen(true)
     } else if (selectedPhotos.length === 0 && rightSidebarOpen) {
       setRightSidebarOpen(false)
     }
-  }
+  }, [viewMode, selectedPhotos.length, rightSidebarOpen])
 
   const showRightSidebar = rightSidebarOpen && viewMode === 'grid'